API Keys

You can manage keys from your Profile (user keys) or Workspace Settings (runtime keys).

Key Types

Skilder provides two types of API keys:

User keys created before the SKA_ format was introduced start with USK instead. Those keys keep working indefinitely — the UI marks them "Deprecated format", and rotating them (revoke + generate a new key) is recommended.

User Keys are what agents and API clients authenticate with — every action is attributed to the user the key belongs to, scoped to one workspace.

Runtime Keys identify a self-hosted runtime process. Set one as RUNTIME_KEY in the runtime's environment. A runtime can hold several active keys at once, so rotation is: generate a new key, switch the deployment over, revoke the old one.

Creating an API Key

Every key is shown exactly once, at creation. Skilder cannot re-display a key afterwards — if you lose one, revoke it and generate a new key.

User Keys

1. Click your avatar (top-right) > Profile.
2. Select the API Keys tab.
3. Click Generate New Key.
4. Choose the workspace, enter a description, pick an expiry (and optionally scopes), then click Generate Key.
5. Copy the key immediately — it starts with SKA_ and is shown only once.

Runtime Keys

1. Click your avatar (top-right) > Workspace Settings.
2. Select the Runtimes tab and find the Runtime keys section.
3. Click Generate key.
4. Choose the runtime, enter a description and an expiry, then click Generate key.
5. Copy the key immediately — it starts with RTK_ and is shown only once.

Revoking a Key

When a key is compromised or no longer needed, revoke it:

1. Open Profile (for user keys) or Workspace Settings > Runtimes (for runtime keys).
2. Find the key and click Revoke.
3. Confirm the action.

Revocation is immediate. Any agent using the key loses access instantly. This action cannot be undone — you must generate a new key if you need to restore access.

Best Practices

Use descriptive names

Name keys after their purpose or the agent that uses them. "Slack Support Bot - Production" is better than "Key 1". You will thank yourself when reviewing keys months later.

One key per agent

Give each agent its own API key. This lets you revoke access for a single agent without affecting others, and makes audit logs easier to read.

Rotate keys regularly

Periodically create new keys and retire old ones. This limits the blast radius if a key is leaked without your knowledge.

Monitor usage

Review which keys are active and when they were last used. Revoke keys that have been inactive for an extended period.

Permissions Model

When an agent connects with an API key, it can access skills through the roles in the workspace:

API Key → Workspace → Roles → Skills → Tools

The agent discovers roles and their skills. Each role groups a set of skills, and each skill provides access to specific tools. To limit what an agent can access, organize skills into separate roles and assign roles to the appropriate teams. You can also use separate workspaces for different teams or environments.